# CVE-2026-107479: Qt Framework integer truncation in QTextCodec conversion

Source: https://junglewise.ai/threats/cve-2026-107479-an-integer-truncation-vulnerability-in-the-qtextcodec-conversion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-107479 · Severity: info · Published 2026-11-04

Qt Framework is a widely-used cross-platform application development library. An integer truncation vulnerability in the QTextCodec conversion functions can cause applications using this functionality to crash unexpectedly, resulting in application unavailability.

Technologies: [Qt Framework](https://junglewise.ai/threats/technologies/qt-qt-framework). Vendors: [Qt](https://junglewise.ai/threats/vendors/qt).

## Quick answers

**Is CVE-2026-107479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107479 being exploited in the wild.

**How severe is CVE-2026-107479?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Qt Framework 5.0.0 to 6.8.8, 6.9.0 to 6.11.2.

**Is there a fix for CVE-2026-107479?** Yes: fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107479 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-107479?** Check whether you run Qt Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0

## Technical details

An integer truncation vulnerability exists in the QTextCodec conversion functions within the Qt 5 Core Compatibility APIs module. The vulnerability can be triggered during character encoding/decoding operations and leads to a denial of service through application crash. No authentication or user interaction is required beyond normal use of the affected APIs.

## Affected products

- Qt Qt Framework 5.0.0 to 6.8.8, 6.9.0 to 6.11.2

## Timeline

- 2026-11-04: disclosed

## References

- [https://codereview.qt-project.org/c/qt/qt5compat/+/763226](https://codereview.qt-project.org/c/qt/qt5compat/+/763226)
- [https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products](https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products)

## Related threats

- [Qt Framework NULL pointer dereference in QDomDocument XML parsing](https://junglewise.ai/threats/cve-2026-82292-a-null-pointer-dereference-vulnerability-in-the-qt-framework)
- [Qt Framework uncontrolled resource consumption in HTTP response handling](https://junglewise.ai/threats/cve-2026-116337-uncontrolled-resource-consumption-vulnerability-in-the-qt)
- [Qt Framework QWebSocket authentication information disclosure](https://junglewise.ai/threats/cve-2026-114366-an-information-disclosure-vulnerability-in-the-qt-framework)
- [Qt Framework out-of-bounds write in Qt3D assimp plugin](https://junglewise.ai/threats/cve-2026-111487-an-out-of-bounds-write-vulnerability-in-the-qt-framework-assimp)
- [Qt Framework out-of-bounds read in QCborValue::fromCbor()](https://junglewise.ai/threats/cve-2026-107157-out-of-bounds-read-vulnerability-in-qcborvalue-fromcbor-impacts)